gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Avoid use of improper parameters in escapeString

Browse Source 
Fix #12735

Signed-off-by: Deven Bansod <devenbansod.bits@gmail.com>
This commit is contained in:
Deven Bansod 2016-11-25 17:56:31 +05:30
parent 6497f5ab77
commit deeb3e62df
2 changed files with 9 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libraries/navigation/nodes/Node.php
View File

@ -722,7 +722,7 @@ class Node
if (!empty($GLOBALS['cfg']['Server']['hide_db'])) {
$whereClause .= "AND " . Util::backquote($columnName)
. " NOT REGEXP '"
. $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['hide_db'], true)
. $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['hide_db'])
. "' ";
}
@ -737,7 +737,7 @@ class Node
foreach ($GLOBALS['cfg']['Server']['only_db'] as $each_only_db) {
$subClauses[] = " " . Util::backquote($columnName)
. " LIKE '"
. $GLOBALS['dbi']->escapeString($each_only_db, true) . "' ";
. $GLOBALS['dbi']->escapeString($each_only_db) . "' ";
}
$whereClause .= implode("OR", $subClauses) . ") ";
}

30
libraries/navigation/nodes/NodeDatabase.php
View File

@ -342,7 +342,7 @@ class NodeDatabase extends Node
$query .= "'" . $GLOBALS['dbi']->escapeString($searchClause) . "'";
} else {
$query .= Util::backquote($columnName) . " LIKE ";
$query .= "'%" . $GLOBALS['dbi']->escapeString($searchClause, true)
$query .= "'%" . $GLOBALS['dbi']->escapeString($searchClause)
. "%'";
}
@ -459,10 +459,7 @@ class NodeDatabase extends Node
$query .= "AND `TABLE_TYPE`" . $condition . "'BASE TABLE' ";
if (! empty($searchClause)) {
$query .= "AND `TABLE_NAME` LIKE '%";
$query .= $GLOBALS['dbi']->escapeString(
$searchClause,
true
);
$query .= $GLOBALS['dbi']->escapeString($searchClause);
$query .= "%'";
}
$query .= "ORDER BY `TABLE_NAME` ASC ";
@ -477,8 +474,7 @@ class NodeDatabase extends Node
"Tables_in_" . $db
);
$query .= " LIKE '%" . $GLOBALS['dbi']->escapeString(
$searchClause,
true
$searchClause
);
$query .= "%'";
}
@ -550,10 +546,7 @@ class NodeDatabase extends Node
$query .= "AND `ROUTINE_TYPE`='" . $routineType . "' ";
if (!empty($searchClause)) {
$query .= "AND `ROUTINE_NAME` LIKE '%";
$query .= $GLOBALS['dbi']->escapeString(
$searchClause,
true
);
$query .= $GLOBALS['dbi']->escapeString($searchClause);
$query .= "%'";
}
$query .= "ORDER BY `ROUTINE_NAME` ASC ";
@ -564,10 +557,7 @@ class NodeDatabase extends Node
$query = "SHOW " . $routineType . " STATUS WHERE `Db`='$escdDb' ";
if (!empty($searchClause)) {
$query .= "AND `Name` LIKE '%";
$query .= $GLOBALS['dbi']->escapeString(
$searchClause,
true
);
$query .= $GLOBALS['dbi']->escapeString($searchClause);
$query .= "%'";
}
$handle = $GLOBALS['dbi']->tryQuery($query);
@ -636,10 +626,7 @@ class NodeDatabase extends Node
. Util::getCollateForIS() . "='$escdDb' ";
if (!empty($searchClause)) {
$query .= "AND `EVENT_NAME` LIKE '%";
$query .= $GLOBALS['dbi']->escapeString(
$searchClause,
true
);
$query .= $GLOBALS['dbi']->escapeString($searchClause);
$query .= "%'";
}
$query .= "ORDER BY `EVENT_NAME` ASC ";
@ -650,10 +637,7 @@ class NodeDatabase extends Node
$query = "SHOW EVENTS FROM $escdDb ";
if (!empty($searchClause)) {
$query .= "WHERE `Name` LIKE '%";
$query .= $GLOBALS['dbi']->escapeString(
$searchClause,
true
);
$query .= $GLOBALS['dbi']->escapeString($searchClause);
$query .= "%'";
}
$handle = $GLOBALS['dbi']->tryQuery($query);